Qantas Airways Limited v Persons Unknown (No 2)

If (my emphasis) the internet attribution is to be trusted, an American cyber security expert named Chris Painter is said to have observed that “cybersecurity is a continuous cycle of protection, detection, response, and recovery.” This judgment concerns what is part of the response and recovery undertaken by the plaintiff, Qantas Airways Limited, to a now widely reported cybersecurity breach.

On 2 October 2025, the Court made final orders in this matter on the application of Qantas, which was represented by counsel. As has been the case throughout these proceedings, there was no appearance for the defendants, to whom I refer as the threat actors.

The orders, in their slightly redacted form, appear at the end of these reasons. It is necessary, but certainly not encouraging, to observe that this matter may be added to the growing list of applications to the Court by corporations or institutions that have been the victim of a cyber-attack, the exfiltration of confidential data and an extortion attempt by the threat actors: see, for example, HWL Ebsworth Lawyers v Persons Unknown (2024) 113 NSWLR 418 and The University of Notre Dame Australia v Persons Unknown [2025] NSWSC 550.

Assisted by the detailed written and oral submissions of counsel, at the conclusion of the hearing on 2 October 2025, the Court was satisfied that the orders should be made. These reasons reflect acceptance of, and are based upon, those submissions, which the Court acknowledges with gratitude.

Insofar as the final injunction in order 1 is concerned, it is sufficient for me record that the Court was satisfied on the evidence that the necessary jurisdictional and other prerequisites were satisfied for the making of that order. That such an order could be made was determined in HWL Ebsworth. Similarly, subject to the specific matter which is dealt with in these reasons, the suppression and non-publication orders which the Court has made are broadly similar to those made in previous matters and the Court is satisfied they are justified on the evidence in this case.

However, at the time I made the orders, I indicated that I would deliver reasons in relation to the more novel issue raised by the application, being for a six-month non-publication order in relation to the identity of the law firm, solicitors and counsel acting for Qantas in this matter. That is the subject of these reasons.

In summary, in my respectful opinion the Court, as far as it can properly conclude it is necessary to do so, should not make it any easier for threat actors engaged in illegal activity to disrupt innocent people’s lives, including those who are the professional advisers to the victims of that illegal activity. Having regard to the totality of the expert evidence relied upon by Qantas, the Court is satisfied that “in the heat of the battle” and for a short time thereafter (given that the perpetrators will move on to other wrongdoing), there is a sufficiently real risk of harassment or retaliation for retribution and possibly extortion against solicitors and counsel acting for a party such as Qantas that it is necessary (and not just convenient or desirable) to grant limited relief under the Court Suppression and Non-publication Orders Act 2010 (NSW) (the Act).

While it may be assumed that even an offshore threat actor could, with determination, ascertain the identity of those persons, the Court accepts counsel’s argument that publication of their identities is, in counsel’s words, “painting a target” on the backs of those persons. That risk should be ameliorated where, as in this case, proper weight can be given to the essential principle of open justice by, first, only a non-publication order being made and, second, the order being limited to the time the extortion threat is ongoing and a short period thereafter.

I should also record that at each interlocutory step of these proceedings where suppression and non-publication orders have been made, the Court, with the assistance of Qantas, has taken steps to ensure that if the media (or any other interested person) wished to appear as contradictor in relation to any of the orders being sought, they would have a proper opportunity to do so. No one took up that opportunity, including for the final hearing on 2 October 2025.

The matter came before me on 12 September 2025 for the making of final orders. At that time, the Court was provided with a set of all the materials which were proposed to be subject to suppression and non-publication orders. Properly and sensibly, it was accepted by Qantas that a different regime would be appropriate in relation to different types of information. The different categories were identified by colour coding in the materials provided to the Court.

In the course of that hearing, I expressed to counsel my provisional view that, in some respects, an over generous view seemed to have been taken as to what should be the subject of suppression or non-publication orders. I did not make that observation critically or to suggest that an irrational or improper approach had been taken. Given my observations, counsel suggested that the most efficient course would be for Qantas to reconsider its application in the light of my tentative observations, and to revisit what was proposed to be the subject of suppression or non-publication orders by taking a more confined and focused approach. That is what occurred.

As ultimately contended for by Qantas, the categories of information to be the subject of suppression or non-publication orders were reduced to three:

A six month non-publication order was sought in relation to the identity of the law firm, lawyers and counsel acting for Qantas (which information would again nevertheless be available by inspection of the Court file). It is to this aspect to which I will now turn.

In applications for suppression or non-publication, save in cases where judicial notice may be taken, evidence is required as to why the order should be made and for the period sought. In this case, Qantas relied on the report of an international expert. The expert, who had impressive academic qualifications in computing and cybersecurity, leads a company which specialises in advising and assisting victims of cyber-attacks. The expert had been involved in assisting victims of over 1,000 such incidents, including governments, schools, hospitals and critical infrastructure. The Court has no doubt that the expert was well qualified to give their evidence and accepts that evidence.

The expert addressed the risks and concerns arising from the disclosure of identities and personal information of individuals involved in responding to the data breach. It was considered that notification to the threat actor of names of the people at Qantas and their instructed firms in relation to the injunctive proceedings would escalate the situation, possibly leading to additional harassment, harm or other damage. Such action would be motivated by retaliation, notoriety, intelligence gathering and financial gain. The expert outlined the key actions of concern, namely:

The expert expressed the view that in relation to firms and individuals assisting Qantas, the risks should be taken seriously due to the threat actors clearly demonstrating malicious intent through both direct and indirect threats towards Qantas. The expert’s evidence was that, in some instances, other cybercriminal groups have demonstrated a willingness to re-extort victims using data leaked by the original attacker.

Due to the affiliates of this threat actor having an established history of sharing victim information to increase pressure and incite attacks by others, the expert considered the risk of further harassment of Qantas and its instructed firms (see [15(1)] above) to have a high probability of occurring. High probability was defined as between 49% and 75%. The expert considered the risk of doxing or direct physical harm to be possible, despite not being personally aware of this threat actor engaging in such actions. Possible was defined as between 1% and 24% but within the realm of theoretically possible based on the available information and assumptions.

As to individuals, the expert stated that threat actors have been observed to engage in harassment and doxing of individual professionals who were identified as assisting victims. The expert considered the risk of further harassment by the threat actor of those involved in assisting Qantas to be a possibility, as was the risk of doxing and direct physical harm. Possible was again defined as between 1% and 24%.

The expert stated that when communicating with threat actors, the expert’s firm adhered to strict rules of engagement which included never identifying or “shining a spotlight” on an individual or firm, as it may provoke a cyberattack leading to extortion, blackmail or damage to reputation.

The relevant legislation is the Act. The power relied upon to make the orders sought is set out in s 7:

When considering whether to exercise the powers granted under the Act, two sections are relevant:

Section 9 outlines the procedure to be followed:

In terms of duration, s 12 applies:

The law in this area is still evolving, in part reflecting the evolution in cybercrime. However, the foundational principle of open justice has a long history. In Dring (on behalf of the Asbestos Victims Support Groups Forum UK) v Cape Intermediate Holdings Ltd [2020] AC 629 two principal purposes for the open justice principle were identified by the Supreme Court of the United Kingdom:

It was also held that a “fact-specific balancing exercise” is required to be undertaken between:

Drawing on Dring, several aspects of the open justice principle were identified by the ACT Court of Appeal in Zhang v The Age Company Pty Ltd [2023] ACTCA 10 (citations omitted):

The Court of Appeal also found a variety of exceptions to the principle of open justice exist:

The principle of open justice has been repeatedly found to be a key consideration in deciding whether to grant non-publication or suppression orders, particularly in the case of solicitors and counsel. Prior to the commencement of the Act, orders were made under s 72 of the Uniform Civil Procedure Act 2005 (NSW) (CP Act) which states:

In “A” bht “S” v State of NSW [2011] NSWDC 54 (A v State), Levy SC DCJ made interim non-publication orders at the commencement of the hearing over the identities of the counsel and solicitors of the defendant under s 72 of the CP Act. The basis of the orders was stated to be:

Final non-publication orders were then sought, and his Honour considered the application of the principles of open justice to such an order. His Honour found that the provision has a requirement of necessity ([11]), and this “strong word” is to be “determined by considerations of reasonableness” (see [12] and [18]).

When considering the position specifically of judges and counsel, Levy SC DCJ said (citations omitted):

His Honour declined to make the final non-publication orders, finding that the threshold of necessity had not been met where the threats had been made more than six years prior, absent any evidence of recent repetition or current concerns.

On appeal, the decision not to make the final non-publication orders was upheld in State of New South Wales v Plaintiff A [2012] NSWCA 248, with Basten JA (Beazley and Hoeben JJA, as their Honours then were, agreeing) observing (at [101]):

While it was accepted that three incidents had occurred in which counsel and a judge had been threatened, the Court said:

Relying on a similar provision in the Criminal Procedure Act 2011 (NZ), the appellant’s lawyers in Tarrant v The King [2024] NZCA 579 sought a permanent suppression over the publication of their names. The application was opposed by both the Crown and four media organisations. Mr Tarrant was the perpetrator of a mass shooting at a mosque in Christchurch. While the principle of open justice is not mentioned in the section, in finding that such an order should be made, the Court of Appeal stated:

The Court of Appeal rejected the Crown’s submissions that other criminal barristers may be targeted as a scapegoat if a person thought they may be responsible for representing Mr Tarrant. The Court of Appeal found this supported the genuine concerns held as to the safety of the appellant’s lawyers and their families ([42]). Likewise, the Court of Appeal rejected contentions that the cab-rank rule would be undermined, instead seeing the application as one which would protect and strengthen the cab-rank rule “by allowing counsel to represent Mr Tarrant without suffering harm” ([46]).

While it was accepted that people attending the appeal would be able to identify Mr Tarrant’s lawyers, it was held that:

In considering the precedential effect of the decision to make orders suppressing the identity of Mr Tarrant’s lawyers, the Court of Appeal noted (at [55]) that this would be the first case “in any jurisdiction in which current counsel [had] been granted permanent name suppression out of concerns for their wellbeing and security”. The Court of Appeal considered the case of YSA (anonymity of barristers) [2023] UKUT 74. However, the application in that case had arisen due to the media suggesting in their reporting of the matter that the lawyers were bringing unmeritorious challenges to proper governmental actions in order to make money. As such, it was held (at [53]) “that the balance “very clearly” weighed against the applications, and that the proposed order would be a disproportionate response to the media’s right to freedom of expression.”

It has been argued that “the courts need to remain open about employing protective measures to support the secure and proper functioning of the criminal justice system – including, where appropriate, suppressing the identities of legal counsel” (T Epati, ‘Weathering the Storm – Should a Novel Case to Suppress the Identities of Lawyers in a High-Profile Case be that Novel?’ (2025) 99 ALJ 449, 449). Ms Epati explores Tarrant, before looking at the case of Tickle and Summers v BBC, PA [2025] EWCA Civ 42, which reversed a decision to suppress the identity of the judges who had determined interlocutory aspects of what was described as a very difficult and tragic case. Ms Epati observes, and I respectfully agree, that Tickle “is a case which illustrates the boundary between the special position of judges (a public appointment with arguably greater access and protection by way of other security measures) and the professionals who are caught up in the justice system by virtue of their professional obligations.” In considering the application of these authorities to the present case, I have not overlooked that these are not criminal proceedings. However, as the evidence of the expert demonstrates, advisers to victims of cybercrime are themselves vulnerable to retaliation by means which can be practically devastating in the online world in which we now work, even if physical danger is not involved (although it theoretically could be) (see further [52] below).

The Act explicitly incorporates the principle of open justice in s 6, which requires the Court to “take into account that a primary objective of the administration of justice is to safeguard the public interest in open justice.” This requirement was described in Rinehart v Welker [2011] NSWCA 403 by Bathurst CJ and McColl JA (citations omitted):

Turning to cases against “Persons Unknown” and data breaches, the seminal case was that of HWL Ebsworth. Slattery J entered default judgment against the defendants, including orders for injunctive relief restraining any use of the confidential information gained by the defendants. However, no non-publication or suppression orders were sought or granted.

In Notre Dame, Brereton J also entered default judgment against the defendants and granted injunctive relief. His Honour was satisfied that a three year non-publication order should be made over, among others, the names of the plaintiff’s solicitors. No order was made as to the name of the plaintiff’s counsel. It would appear that an application for that relief was not ultimately pressed.

It was submitted, and the Court accepts, that Qantas’ solicitors and counsel were obviously “associated with” Qantas for the purposes of s 7 of the Act. In accordance with s 12(2) of the Act, the duration of an order should be no longer than is necessary to achieve the intended purpose, with the Court favouring an approach where periods are defined and fixed, rather than indefinite (see DRJ v Commissioner of Victims Rights [2020] NSWCA 136 at [46] to [54]). As such, specific time periods had been assigned to reflect the relevant level of risk, such as security secrets having a 5 year period, while lawyers’ names would be protected for a much shorter period.

As to the application of s 8(1) of the Act, it was submitted that ‘necessary’ has been described as a “strong word” which required “reasonably necessary” orders, a bar higher than merely convenient or sensible (Rinehart v Welker at [27] and [29]). Fairfax Digital Australia and New Zealand Pty Ltd v Ibrahim (2012) 83 NSWLR 52 at [46] was relied upon for the proposition that necessity requires consideration of the interplay between the probability of harm, the nature of harm, and the effect of preventative measures. This consideration has also been described as “unacceptable consequences” (R v Kwok (2005) 64 NSWLR 335 at [13]).

It was submitted that there remains utility in the non-publication orders sought, even though some material is available online, as only a limited degree of publication has occurred (see R v Perish; R v Lawton; R v Perish [2011] NSWSC 1102 at [44]). This proposition was submitted to be reinforced where the material is speculative, with counsel relying on the analogous context of confidentiality orders (Australian Football League v The Age Company Ltd (2006) 15 VR 419 at [56]).

Counsel submitted that it is a matter of judicial notice that a shared national and public interest exists in resisting the growing occurrence of digital extortion crimes. Not assisting threat actors in achieving their aims, building their technical capabilities, or threatening victims and their service providers was therefore submitted to be in the public interest for the purposes of s 8(1)(e), a conclusion also relevant to ss 8(1)(a) and (c). The Court accepts those submissions.

Cognately with the public interest, it was submitted that the administration of justice referred to in s 8(1)(a) of the Act is a notion broader than merely preventing prejudice in the particular case, and extends to consequences for future cases. As such, the Court is permitted to consider the systemic effects of exposing security related information and lawyers to threat actors (Ibrahim at [48]). For example, protecting an informant’s identity will assist in obtaining similar evidence in future cases.

Qantas also relied on the safety concern in s 8(1)(c), applying the calculus of risk approach (AB (A Pseudonym) v R (No 3) [2019] NSWCCA 46 at [56]), as well as the several public interests significantly outweighing any public interest against the orders under s 8(1)(e). The imbalance in favour of public interest over the interest in open justice must be significant and not merely be “ever so slightly” in favour of suppression (Welker v Rinehart [2011] NSWSC 1094 at [8] per Brereton J (as his Honour then was)).

It was accepted that any application must be supported by proper material, with a mere belief being insufficient (R v Perish at [42]). Counsel submitted that the expert report, and the evidence from a senior executive at Qantas provided sufficient evidence of the potential risks. I agree.

It was submitted that the names of the lawyers should be subject to a non-publication order for six months, being the estimate of the length of hostilities with the threat actor. The reason for this delayed publication being necessary was stated to be that the threat actor belongs to a class that is known to retaliate and pressure not only its victim, but those assisting the victim, particularly during the negotiation period. While such orders are rare, it was submitted calling them ‘unusual’ would be premature in what was a developing area.

The principal purposes served by the open justice principle in s 6 of the Act was submitted to be ensuring there is public scrutiny of the way in which courts decide cases and to enable the public to understand how the justice system works (Zhang at [43]). It was submitted that the effect on open justice would be slight. Considering lawyers are not the deciders of cases, the principal purposes are not significantly hindered by a temporary restraint on publishing the identity of the lawyers involved. While it was accepted knowledge of the lawyers’ names can permit the detection of certain improprieties in the justice system such as biases or conflicts of interest, the lack of suppression orders and the non-publication being only temporary would allow any potential improprieties to be quickly detected.

It was also accepted that the present case is not one that falls into the more extreme cases justifying a non-publication order, and while it is common for lawyers to receive threats or bear opprobrium when representing particular clients, there is no automatic protection (A v State at [30] to [37]). However, it was submitted that the position with digital extortion has different features, namely:

In favour of the order, counsel put that there is the power to make the orders sought, there is clear evidence that the threat actors are prone to retaliation and pressure campaigns, and members of the profession and media are aware of the identities of the lawyers as the orders are only for non-publication. It was submitted that in attempting to create a systematic approach to dealing with the societal problem, giving institutions a temporary shield protecting them from being targeted by foreign threat actors, where the imposition is limited, was necessary and justified. I accept that submission.

It was also put that the present case can be distinguished from A v State where a suppression order was sought for counsel’s name and was refused. The distinguishing feature was submitted to be that Levy DCJ in that case found the intention of the orders was to prevent the plaintiff from knowing the names, which is at odds with the ability of a person who is prosecuting a case to know who is appearing. On appeal, the Court of Appeal held the evidence for suppressing the names was very weak, considering the threat was a physical threat made by the plaintiff eight years prior. It was also highlighted that in the present case, only a temporary non-publication order is sought. In my respectful view, the evidence of the expert in this case is clear and compelling as to the potential risks, and supports the conclusion which the Court draws that limited non-publication orders are necessary within the meaning of that term in s 8(1) of the Act.

I have recorded that there was no appearance by the defendants. As what occurred was a hearing of which they had notice, it was not an ex parte hearing which engaged the strict duty of candour required of an applicant at such a hearing. The matter proceeded before me in accordance with the principles for undefended hearings recently set out by Griffiths AJ in Take Off Opportunities Pty Ltd atf The Clear Runway Trust v Susan Quinn Pty Ltd atf The Susan Amelia Quinn Trust [2025] NSWSC 231 at [18] and which I gratefully adopt:

Conformably with his duty to assist the Court, and notwithstanding that it was not an ex parte hearing as properly understood, counsel very properly and fairly drew to the Court’s attention arguments contrary to Qantas’ interest, neither of which the Court found sufficiently persuasive to alter the outcome. Counsel put that they do market themselves as appearing in this particular area, and it would not be necessarily difficult for threat actors to identify them as someone who regularly appears in this area. It was also put that the position between solicitor and counsel is different, particularly with counsel having less data stored and a lower potential perception of wealth (compared to a law firm) so as to be less worth pursuing.

The Court has the power under s 7(a) of the Act to make orders for the non-publication of the names of solicitors and counsel in this matter. The grounds relied on are ss 8(a), (c), and (e) and the Court accepts counsel’s submissions as to why those grounds have been made out.

I have considered the principles of open justice as required under s 6 of the Act, and I have concluded this case falls into, or is at least closely analogous to, the established exception category of blackmail and extortion. While the specific order being considered is not of the kind usually made in that category of exception, that such a category of exception exists demonstrates the Court’s recognition of the harm threat actors pose, and a willingness to protect individuals from this harm.

The expert’s evidence supports what might be thought to be the common sense observation that the threat actors have numerous motivations which include retribution and moneymaking. In the case of law firms, depending on their size, financial gain may also be a motive, as HWL Ebsworth demonstrates. It must be accepted that considerable disruption could also be visited on a sole practitioner such as a barrister by cyberattack on the practitioner. As Tarrant shows, protecting counsel may also strengthen the cab-rank rule by allowing victims of threat actors to obtain representation because counsel would be able to discount the possibility of retaliation or suffering other harm.

The expert’s evidence demonstrates a sufficient degree of risk that Qantas’ solicitors and counsel might suffer one or more of the detriments set out at [15] above so as to make necessary the orders sought under the Act. The peak period of risk is during the period of the encounter (‘heat of the battle’) but it may be accepted that for a short period thereafter retribution remains a real possibility against law firms and counsel necessitating protection. Inevitably committed criminals will move on to their next target. The Court has concluded that the period of six months is an appropriate and clearly defined time period for the non-publication orders to be imposed in accordance with s 12 of the Act.

That the orders are for non-publication rather than suppression also strikes an appropriate balance, especially where the threat actor is overseas, and is in keeping with the principles of open justice. While it may be accepted that a determined threat actor could find out the identity of the solicitors or counsel, it is accepted that there is no need to assist the threat actors by providing them with, in counsel’s words, a clear or easy bullseye at which to shoot.

The orders of the Court were: